PT-2026-118502

Name of the Vulnerable Software and Affected Versions sanitize-html versions 2.17.7 through 2.17.9 Description An issue exists where application configurations permitting namespace-prefixed SVG animation elements and relevant URL-targeting attributes can bypass SMIL URL protection. This occurs...

PT-2026-120291

Summary sanitize-html 2.17.7 introduced animatesUrlAttribute to block SVG animation elements animate, animateColor, animateMotion, animateTransform, set when their attributeName targets a URL sink like href. However, this check is bypassed when the animation element uses a namespace prefix e.g.,...